API docs

Base URL: the host you loaded this page from. All responses are JSON with access-control-allow-origin: *. Errors look like {"error":{"code":"…","message":"…"}}.

Authentication

Send an API key as Authorization: Bearer bc_live_…. Without a key, /v1/check and /v1/domain work at about 10 checks per minute per IP. A bad or unknown key returns 401 invalid_api_key; it never falls back to anonymous use. Repeated invalid keys from one IP get 429 too_many_failed_auth for a minute. API keys are issued by request during early access (no self-serve signup yet): email digitalpromohub.support+burnercheck@gmail.com.

POST /v1/check (recommended) · GET /v1/check?email=

Use POST. It keeps the address out of the URL. Body {"email":"…"}, Content-Type: application/json, at most 16 KB. GET with ?email= also works and returns the same result, but the address is then part of the URL (see Privacy).

curl -X POST -H "Authorization: Bearer $KEY" -H "content-type: application/json" \
  -d '{"email":"jane@yahooo.com"}' "https://<host>/v1/check"

{
  "email": "jane@yahooo.com",
  "domain": "yahooo.com",
  "valid_syntax": true,
  "disposable": false,
  "role": false,
  "free_provider": false,
  "suggestion": "jane@yahoo.com",
  "confusable": false,
  "list_version": "2026-10-13.d1a9c51"
}

Input over 320 characters → 400 input_too_long. Missing email → 400 missing_email. POST: body over 16 KB → 413, not JSON → 415/400 invalid_json. POST and GET share the same rate limits and quota.

GET /v1/domain/{domain}

The same check for a domain only. It never needs or accepts a local part (anything with @ → 400 domain_only), so you can check sign-ups without sending addresses at all.

curl "https://<host>/v1/domain/mailinator.com"
{ "domain": "mailinator.com", "valid_syntax": true, "disposable": true, "free_provider": false, "suggestion": null, "confusable": false, "list_version": "2026-10-13.d1a9c51" }

POST /v1/check/batch

Planned for paid plans (Pro, Business; not on sale yet), so it needs a paid-plan key. Body {"emails":[…]}, 1–100 strings, Content-Type: application/json, at most 16 KB (16,384 bytes). Each address counts as one check.

curl -X POST -H "Authorization: Bearer $KEY" -H "content-type: application/json" \
  -d '{"emails":["a@mailinator.com","info@example.com"]}' "https://<host>/v1/check/batch"
{ "count": 2, "list_version": "…", "results": [ { …same shape as /v1/check… }, … ] }

Errors: no key 401 api_key_required; free key 403 paid_plan_required ("planned for paid plans"); body over 16 KB 413 body_too_large (checked from Content-Length before reading, and again on the real bytes); more than 100 400 too_many_emails; not JSON 415/400 invalid_json; not enough quota left for the whole batch 429 quota_exceeded (nothing is charged).

GET /v1/meta

Service version and build (git commit), list version, domain count, allowlist size, last refresh time, source commit and licence, and the current limits. Not rate limited and not counted.

Limits and quota headers

• No key: about 10 checks/min per IP (shared with the web checker).
• With a key: about 120 requests/min per key (a batch call counts as one request), plus the monthly quota of the plan (UTC calendar month).
• Keyed responses carry x-quota-limit, x-quota-remaining, x-quota-reset.
• 429 codes: rate_limited (per minute), quota_exceeded (monthly), daily_capacity_reached (the service's shared daily capacity, resets 00:00 UTC). All include retry-after.

Pricing (planned)

Paid plans are not on sale yet. This is the planned pricing:

The web checker on the home page stays free.

Privacy

• BurnerCheck stores no addresses or domains. The value you check is processed in memory and returned to you. The only things stored are counters (checks per API key per month, total checks per day) and API key hashes. The Worker writes no logs, and Workers Logs/observability are switched off in its configuration ([observability] enabled = false); there is no Logpush and no tail consumer.
• The web checker uses POST. Full addresses are sent in the request body, never in the page URL or your browser history. Shareable /?q= links and "did you mean" links contain the domain only.
• GET /v1/check puts the address in the URL, where Cloudflare processes it in transit and account holders can see it in a live log tail. Use POST /v1/check or /v1/domain if that matters.
• Domains only, if you prefer. /v1/domain/{domain} and the web checker's domain mode never see the part before the @.
• No MX/DNS lookups, no outside requests. Every check is answered from data bundled with the Worker. No mail server is contacted.
• Rate limiting uses your IP address in Cloudflare's rate-limiting counters only; BurnerCheck doesn't store it. The site sets no cookies and loads no third-party scripts, fonts or trackers.

Limitations

• List-based. "Disposable" means the domain (or a parent) is on the disposable-email-domains list. New throwaway domains are missed until the list adds them and BurnerCheck refreshes its copy. disposable: false means "not on our list", not "safe".
• No MX or mailbox check. BurnerCheck never contacts DNS or mail servers, so it can't tell whether a domain accepts mail.
• A valid format doesn't mean the address exists. valid_syntax is a practical format check (no quoted local parts, IP-literal domains or non-ASCII local parts).
• Role and free-provider lists are curated and not exhaustive. Typo suggestions cover a short list of big webmail domains, one-character typos only. The lookalike check covers accented letters and common Cyrillic/Greek look-alikes, not every confusable character. A few real Cyrillic words spelled only with Latin-looking letters (for example "оса.com") are flagged too, as in browsers.
• Rate limits and the daily capacity are approximate.

Changes

Changes in 0.1.3

• Fix: the whole-name rule in confusable is narrower. It now counts only Cyrillic letters that look like lowercase Latin letters (а с ԁ е һ і ј ӏ о р ԛ ѕ ԝ х у ү), so real words such as москва.com, метро.com, кот.net, κινητο.com or τεχνη.com are no longer flagged. There is no all-Greek rule any more; Greek look-alikes of known domains (for example yahοo.com) are still flagged.

Changes in 0.1.2

• confusable now also flags accented look-alikes of known domains (gmáil.com, gmäil.com) and .com/.net/.org names written entirely in Cyrillic or Greek letters that look Latin (for example "аррӏе.com").
• The 400 domain_only message on /v1/domain now points to POST /v1/check.

Changes in 0.1.1 (2026-10-03). Existing fields are unchanged. If you parse responses strictly, note:

• New field confusable (boolean) on /v1/check, /v1/domain and batch results.
• New POST /v1/check with a JSON body (recommended). GET /v1/check?email= still works.
• Fewer suggestions. suggestion is now only given for one-character typos of a big webmail domain, never for a domain on any of our lists, and never across a real country ending. Domains that got a suggestion before and no longer do include listed typo-domains such as gmial.com, regional providers such as hotmail.ca or yahoo.co.nz, and .co/.cm/.om endings.
• Many more regional free-mail domains count as free_provider (for example hotmail.co.uk, yahoo.co.nz, gmx.de, web.de).
• Subdomains of any depth under a listed domain are detected. /v1/meta has a build field. Repeated invalid API keys from one IP get 429 too_many_failed_auth.

Data source and licence

Disposable domains come from disposable-email-domains/disposable-email-domains, released under CC0 1.0 Universal (public domain dedication). Current list: 9,881 domains, version 2026-10-13.d1a9c51 (upstream commit d1a9c51f29de15e8dab2f5ed8bda90a711ef6cb9), refreshed 2026-10-14. Thank you to its maintainers and contributors.

The allowlist combines the upstream project's last published allowlist (removed upstream in April 2026, same CC0 licence) with BurnerCheck's own false-positive fixes. Role and free-provider lists are curated by BurnerCheck.

Report a false positive

If a real, long-lived mail provider is flagged as disposable, email digitalpromohub.support+burnercheck@gmail.com with the domain and why it isn't disposable. Confirmed reports go on the BurnerCheck allowlist and take effect with the next deploy. You can also ask the upstream project to remove it.